CVE-2025-39999
In the Linux kernel, the following vulnerability has been resolved: blk-mq: fix blk_mq_tags double free while nr_requests grown In the case user trigger tags grow by queue sysfs attribute nr_requests, hctx->sched_tags will be freed directly and replaced with a new allocated tags, see blk_mq_tag_update_depth(). The problem is that hctx->sched_tags is from elevator->et->tags, while et->tags is still the freed tags, hence later elevator exit will try to free the tags again, causing kernel panic. Fix this problem by replacing et->tags with new allocated tags as well. Noted there are still some long term problems that will require some refactor to be fixed thoroughly[1]. [1] https://lore.kernel.org/all/[email protected]/
Affected versions
Linux kernel versions
6.16.4,
6.17
and later are affected. Fixed in
6.16.11,
6.17.1,
6.18
and their respective stable series.
References
The following references provide additional information about CVE-2025-39999 including vendor advisories, patch commits, exploit details, and third-party analysis. Links are sourced from the NIST NVD database.
-
PatchKernel patch commithttps://git.kernel.org/stable/c/392b1d64911f4de8887fe8b68299fa8bd6e5b923
-
PatchKernel patch commithttps://git.kernel.org/stable/c/8faee580d63bc2a54a59dcdb7f9ce4de29384fec
-
PatchKernel patch commithttps://git.kernel.org/stable/c/ba28afbd9eff2a6370f23ef4e6a036ab0cfda409
Frequently asked questions
-
What is CVE-2025-39999?
CVE-2025-39999 is a unscored severity Linux kernel vulnerability . It affects Linux kernel versions from 6.16.4 onward and has been patched in 6.16.11, 6.17.1 and 6.18. CVE-2025-39999 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
-
Is there a patch available for CVE-2025-39999?
Yes — CVE-2025-39999 has been patched. Fixed versions include 6.16.11, 6.17.1 and 6.18. If you are running Linux kernel 6.16.4 or later up to the fix versions, apply the relevant patch for your kernel branch.
-
Is CVE-2025-39999 actively exploited?
No — CVE-2025-39999 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.